Hacker News Reader

I don't see the point of this article, it's just common sense. If you plan which parts of the DOM are replaced using HTMX, never trust user input. You'll be fine. I use Golang with HTMX and it's amazingly productive.

View on HN

Not everyone's as knowledged, hence information should be shared

And fortunately, it was https://htmx.org/essays/web-security-basics-with-htmx/

I think the point is that htmx is in no way special. It's the same old category of vulnerability. It's why we have execvpe. It's why we have mysql_real_escape_string_no_really_we_mean_it_this_time().

I remember a similar point being made about LLM output. Now, I'm anything but a LLM fanboy, but if you pipe unknown text into a system interface that's squarely on you.

I mean that's the point. Reminding people of possible dangers is one very important security mission.

I think the point being made that you're replying to is that it has nothing to do with htmx. It isn't htmx that's not playing well with content security policy.

Using htmx effectively prevents using CSP for security hardening.

Reply on news.ycombinator.com